Apache Kafka: Denial of service via unbounded memory allocation

Apache Software Foundation Apache Kafka

Apache Kafka before 4.1.2, 4.2.1, and 4.3.1 has a denial of service vulnerability via unbounded memory allocation in Kafka deserialization paths.

Do this now

Check the Apache Kafka advisory for a fix and restrict client access to Kafka brokers meanwhile.

Still cooking for Apache Kafka.

First seen: 28 Oct 2026
Last update: 28 Oct 2026, 18:19 UTC
Identifiers: CVE-2026-111551
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apache Kafka: Denial of service via unbounded memory allocation
Severity: unknown. Patch status: fix status unknown.
Affected: Apache Software Foundation Apache Kafka
Ids: CVE-2026-111551

Apache Kafka before 4.1.2, 4.2.1, and 4.3.1 has a denial of service vulnerability via unbounded memory allocation in Kafka deserialization paths.

## Steps
1. Search the repo, its CI and infra config for Apache Software Foundation Apache Kafka. If present, report the version in use and whether it's affected.
2. Apache Kafka 4.3.x, 4.2.x, <= 4.1.2: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Apache Kafka <= 4.1.2 to 4.3 (3 lines) | not named in the CVE record | check the vendor advisory | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-111551") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/420
https://pwned.coffee/i/apache-kafka-denial-of-service-via-unbounded-memory-allo-cve-2026-111551

Timeline

28 Oct 2026, 18:19 UTC
Fix status: patched → unknown.
28 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Apache Kafka <= 4.3.1 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 28 Oct
Apache Kafka <= 4.2.1 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 28 Oct
Apache Kafka <= 4.1.2 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 28 Oct
Score: No CVSS published yet: severity unknown.
Last checked: 28 Oct 2026, 18:19 UTC

Product	Affected	Fixed in	Source
Apache Kafka	<= 4.3.1	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 28 Oct
Apache Kafka	<= 4.2.1	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 28 Oct
Apache Kafka	<= 4.1.2	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 28 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

seclists.org: CVE-2026-111551: Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone coffee